Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How are you implementing GDPR-compliant soft deletes?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 86 posts

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#51

Post by X4lldux »

jacquesm wrote: post #41
the_mitsuhiko wrote: post #39

Earlier quoted context omitted.

You are legally required to retain payment history anyways for many years. So that's out of the GDPR scope.

No, it is in scope. It is just that the laws are not always consistent. And that's a problem, because you can't be the arbiter of which law takes precedence.

point b of Article 17(1) of GDPR specifically says: (...) and where there is no other legal ground for the processing;

Compliance with tax & financial regulations counts as a "legal ground". But that doesn't mean companies can retain all of the email history.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#52

Post by jacquesm »

kasey_junk wrote: post #42
devdad wrote: post #32

Earlier quoted context omitted.

Is this a real issue though? If I comply to regulations to remove data as required by law, I'd be surprised if a government body could require me to provide data I am supposed to have deleted.

This is a very real GDPR fear. Some of its mandates run counter to other local data retention mandates. It’s not clear yet how that is going to shake out.

As HN'er detaro notes in this comment:

https://news.ycombinator.com/item?id=16366864

There are some provisions for those situations.

And on the subject of backups, those are typically exempt but there are some obvious problems there when you restore a backup at a later time.

To me the big ticket items in the GDPR are the notification duty and the data processing agreement 'chain' that gives some level of certainty that the companies you deal with are going to take this serious.

The implementation details and all the moving bits and pieces are most likely not going to be the parts where the real tests will be in the first year or two.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#53

Post by rbf »

andriesvh wrote: post #28
Ezku wrote: post #24

> it helps for documentation purpose should the dispute arise over some issue in future. If you are required to hold on to the data for legal purposes such as dispute settlement, there is no issue. The customer can request you delete such data but you have no obligation to do so. Issues arise when holding on to the data is no longer "necessary". At that point soft deletion is not enough and you must be able to remove…

Are you sure about throwing away encryption keys is sufficient to be GDPR complient? Does this comes from IP lawyer as well?

If the information no longer is possible to decrypt, it would no longer be considered personal data.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#54

Post by jacquesm »

ust wrote: post #49
jacquesm wrote: post #33

Earlier quoted context omitted.

I'm going to go out on a limb here and guess that 99% of the companies out there affected by the GDPR and the OP in particular do not have a DPO (yet), and may not realize they need one, and even if they do know that then they likely won't be able to fill the seat either in time or with someone competent. Every year we look at quite a few companies, this is the first year that I've spotted a DPO in the wild, and impr…

Not every company needs a DPO though, e.g. check here: https://www.eugdpr.org/key-changes.html Maybe his company doesn't need one. Of course, whether he has a DPO or not, still the question remains of how to "properly" delete the personal data.

It is quite well possible their company does not need a DPO. But given the nature of the question there is some evidence they do, besides that hiring a DPO is not something done in isolation but most likely as as the result of a GDPR impact study done in ... 2017 or so, which I'm going to again guess was not in the cards for many companies.

So, in summary: likely the vast majority of the companies affected is only now starting to wake up to the fact that they are affected, for quite a few of these companies the effects will be relatively benign unless their servers are compromised, for the more serious offender and the larger companies that have not yet started to address these issues it is likely too late to get anything done in time but since this goes for the vast majority of them they are simply playing a complicated game of Russian roulette with the oversight bodies and a couple of them will undoubtedly get lucky to great relief of the remainder.

Data protection authorities tend to be vastly understaffed, but this too will hopefully change in the future.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#55

Post by jacquesm »

X4lldux wrote: post #51
jacquesm wrote: post #41

Earlier quoted context omitted.

No, it is in scope. It is just that the laws are not always consistent. And that's a problem, because you can't be the arbiter of which law takes precedence.

point b of Article 17(1) of GDPR specifically says: (...) and where there is no other legal ground for the processing; Compliance with tax & financial regulations counts as a "legal ground". But that doesn't mean companies can retain all of the email history.

Exactly, you need to make this decision on a per-data item level. Financial transactions are at a different level than other customer interactions, and whatever the local laws for retention of accounting data state is what you will have to mark very explicitly as exempt.

This can get quite complicated, moreso if a company deals with both consumers and companies as customers.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#56

Post by roel_v »

eb0la wrote: post #26

Consult your Data Protection Officer first. GDPR says you must delete information about the customer; but there are cases where you still might need to have that data available. If your customer can interact with another one inside your app/platform, he/she can commit a crime, and you might be required by court (and by law) to disclose some information (even conversations! inside the platform). Setting something to "…

Is there anyone reading this whose company has a DPO already? Is it an internal or external person? How technical are they? I'm a developer and I have a law degree; would that put me in an advantageous position to become one? Is there a market for 'consulting DPO's', like companies hire accountants, if that's allowed? Or do the big consultancy firms have the GDPR market cornered already? I wouldn't want to go in a direction where I would become what today's 'security auditors' do - go through a checklist of mostly irrelevant topics, drum up a list of 'recommendations' that usually aren't relevant or misunderstanding the situation but nobody cares anyway because it's all just busywork to get 'certified' for this or that (or insurance requires it). But if it would be actually working with technical teams on questions like this, that would be interesting.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#57

Post by no1youknowz »

jacquesm wrote: post #46
no1youknowz wrote: post #43

Earlier quoted context omitted.

> you will find that anybody that is capable Define capable. Look at this thread as an example. Many answers contradict each other. There are so many ways to interpret the guidelines, which in many cases have not been thought through. I have engaged in discussions with 5 companies located in the UK. All gave differing answers on specific questions relating to data for marketing, finance, and fraud.

That was my point. You need to know the law inside out to be able to tell someone exactly what to do in their situation. We - our little band of friends - have been reading up on this subject since the previous privacy law was enacted and all I can tell you is that it is much easier to spot things that are in conflict with the law(s) as written than to come up with a single workable solution that does not leave thing…

> That was my point.

Was it?

Let me be blunt for a second. When someone asks for recommendations. If you are able to help that person, then please do so. It helps them and it may help others in the HN community.

What you should not be doing, is your previous reply. In no way was it warranted, nor was it solicited.

If you wish to make such statements known. Feel free to post your own comment or replying elsewhere.

I cannot believe some elements of HN behave in this manner.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#58

Post by otp124 »

tyfon wrote: post #17
samsari wrote: post #15

Earlier quoted context omitted.

My understanding, as someone implementing the GDPR-compliance for my company right now, is that if you could produce the same one-way hash a second time from the same input email address then the hash is still considered PI.

Yep, we've been through this discussion where I work just a few days ago and one way hashing even with salt is _not_ compliant as you can search for whatever you hashed and get a hit (SSNs, emails etc).

While GP stated soft-deletes aren't allowed, I figured I'd contribute to this thought exercise.

What about symmetric encrypting the field(s) and then giving the customer the key, and tell them to print it or store it safely, or else they won't be able to recover? And then don't store the key or write it to disk (remove it from memory)

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#59

Post by jacquesm »

no1youknowz wrote: post #57
jacquesm wrote: post #46

Earlier quoted context omitted.

That was my point. You need to know the law inside out to be able to tell someone exactly what to do in their situation. We - our little band of friends - have been reading up on this subject since the previous privacy law was enacted and all I can tell you is that it is much easier to spot things that are in conflict with the law(s) as written than to come up with a single workable solution that does not leave thing…

> That was my point. Was it? Let me be blunt for a second. When someone asks for recommendations. If you are able to help that person, then please do so. It helps them and it may help others in the HN community. What you should not be doing, is your previous reply. In no way was it warranted, nor was it solicited. If you wish to make such statements known. Feel free to post your own comment or replying elsewhere. I c…

> When someone asks for recommendations. If you are able to help that person, then please do so.

No. Recommending commercial entities to others is not what HN is for.

If you want such a thing you are more than welcome to contact me or others out-of-band.

> It helps them and it may help others in the HN community.

Yes, or it may steer them in the wrong direction entirely.

I don't think this sort of advice is best dispensed through a public forum, reputations of companies are at stake and without enough context it is impossible to make a good advice to begin with.

It is closely related to people dispensing legal advice in forums, better yet if they're not lawyers. The line that comes to mind is 'advice is worth what you pay for it'.

> What you should not be doing, is your previous reply. In no way was it warranted, nor was it solicited.

That's your opinion, mine is a different one.

I get regularly asked to recommend services or companies (by those companies and by their prospective customers) and as a rule I will only do this if I familiar with both parties and consider them a good fit.

That's a thing borne from experience, which again you may disagree with but this has served me well over the years.

> I cannot believe some elements of HN behave in this manner.

And I can not believe that you feel that you are doing any better with this comment.

Re: Ask HN: How are you implementing GDPR-compliant soft deletes?

#60

Post by jacquesm »

roel_v wrote: post #56
eb0la wrote: post #26

Consult your Data Protection Officer first. GDPR says you must delete information about the customer; but there are cases where you still might need to have that data available. If your customer can interact with another one inside your app/platform, he/she can commit a crime, and you might be required by court (and by law) to disclose some information (even conversations! inside the platform). Setting something to "…

Is there anyone reading this whose company has a DPO already? Is it an internal or external person? How technical are they? I'm a developer and I have a law degree; would that put me in an advantageous position to become one? Is there a market for 'consulting DPO's', like companies hire accountants, if that's allowed? Or do the big consultancy firms have the GDPR market cornered already? I wouldn't want to go in a di…

> Is there anyone reading this whose company has a DPO already?

I've seen one in all of 2017 (out of ~20 companies).

> Is it an internal or external person?

In that case it was internal

> How technical are they?

More legal than technical, but that's a very small sample.

> I'm a developer and I have a law degree; would that put me in an advantageous position to become one?

Yes. In fact that's probably one of the most lucrative combinations of fields.

> Is there a market for 'consulting DPO's', like companies hire accountants, if that's allowed?

YES! In fact if you are halfway decent this would be an extremely lucrative thing to do, but it probably will become less so over time as the knowledge gets diffused.

Post reply on HN